Confidentiality & document security

In transit

The whole site, including the order form, is served over HTTPS with TLS. Uploads go straight from your browser to our server over that encrypted connection. We do not accept documents over unencrypted channels, and we will not ask you to send one.

At rest

• Uploaded files are written to storage outside the public web root, so no document is reachable by guessing a URL.
• Filenames are replaced with random references on arrival; the original name is kept only in the order record.
• Directory listing and direct execution are disabled in the storage directory at the web-server level.
• Administrative access is limited to named accounts with two-factor authentication.

How your finished files reach you

When your work is done we email you that it is ready — but the email carries a link, not the documents. You sign in to your account and download them from your order page. That way a forwarded email, or a mailbox someone else can read, does not hand over your manuscript.

Every download is checked against the order before a single byte is sent, and is recorded, so both of us know what was collected and when.

Who can open your document

Access is granted per order rather than per person. The editor assigned to your order can open your file; other editors cannot. A coordinator sees the file to check the word count and match a specialist. Nobody else at ProofreadLab opens it unless you raise a quality concern, in which case the senior editor reviewing it is granted access for that purpose and it is logged.

Editor and translator obligations

Before their first order, every editor and translator signs a confidentiality agreement that requires them to:

• treat everything in your document as confidential and unpublished;
• work on the file only for the purpose of your order;
• delete all local copies when the order closes;
• not submit any part of your text to third-party services, including public AI and translation tools;
• not discuss, cite or reuse your material in any form.

These obligations continue after the working relationship ends.

Deletion schedule

Your source file, the edited versions and any derived files are deleted 30 days after delivery by default. The 30 days exist so that you can come back during the revision window without re-uploading.

• Immediate deletion on request, once you confirm you have received everything.
• Shorter window if your funder, ethics approval or institution requires one — tell us in the order notes and we set it.
• After deletion we keep only the order record: reference, dates, service, price, and your contact details for accounting and tax purposes. No document content is retained.

AI, training data and reuse

Your text is not used to train anything. It is not added to a shared translation memory, a corpus, a sample library or a marketing case study. We do not send your document to third-party AI services, and our editors are prohibited from doing so. If you require this in writing for an ethics application or a funder, ask and we will issue it on letterhead.

Non-disclosure agreements

We are happy to sign your institution's NDA before you send anything. Email it to contact@proofreadlab.com. If you would rather use ours, we will send our standard mutual agreement on request. There is no charge either way.

Sensitive and regulated material

If your document contains personal data about research participants, clinical records, or material covered by an ethics protocol or a data-sharing agreement, tell us before you upload. In most cases the right answer is to send a pseudonymised copy. Where that is not possible, we will agree handling terms in writing first — including a named editor, a shortened deletion window and, if required, a signed data-processing agreement.

Reporting a problem

If you believe a document has been mishandled, or you receive a message claiming to be from ProofreadLab that asks for card details or an unusual payment, email support@proofreadlab.com. We respond to security reports within one working day.